Security audit

guaikei-search

Security checks across malware telemetry and agentic risk

Overview

This skill queries public Xiaohongshu data through a third-party API and saves results locally, and those behaviors are mostly disclosed and aligned with its analytics purpose.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and the GUAIKEI_API_TOKEN to the guaikei.com API. Treat saved logs as potentially sensitive business research and delete or protect them when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The top-level description advertises only keyword search, but the skill also supports note detail/comment retrieval, creator profile monitoring, and local log writing. This mismatch can cause users or orchestrators to invoke the skill under a narrower trust assumption than its actual behavior, increasing the risk of unintended data access, broader third-party data exfiltration, and silent persistence of retrieved content on disk.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The changelog advertises capabilities that exceed the declared manifest scope, including note-detail/comment sentiment analysis and creator monitoring. This kind of scope drift is dangerous because reviewers and users may grant trust or permissions based on the narrower manifest while the skill documentation signals broader collection and profiling behavior, increasing the risk of undisclosed data use and policy evasion.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation advertises three capabilities—keyword search, note detail/comment retrieval, and creator post enumeration—while the skill metadata describes only keyword search. This scope mismatch can cause an orchestrator or user to invoke undocumented-in-manifest behaviors, expanding access to URLs, comments, and profile data beyond the declared trust boundary and weakening security review assumptions.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This file implements note-detail and comment retrieval by URL, which materially expands the skill beyond the declared keyword-search scope in the manifest. Scope mismatch is dangerous because it can enable undisclosed collection of user/content metadata and comments, defeating user and platform expectations and increasing the chance of unauthorized data access or policy bypass.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This CLI performs note-detail and comment retrieval, which goes beyond the declared skill scope of keyword search only. Scope expansion is security-relevant because users and platform reviewers may authorize or trust the skill for limited search functionality, while the code actually collects additional content and metadata that may be more sensitive and create compliance or privacy exposure.

Context-Inappropriate Capability

Low

Confidence: 85% confidence
Finding: The code writes fetched results, including note detail/comment data, to a local file via log.taskWrite without any visible consent, retention control, or minimization. Persisting scraped content increases the blast radius of accidental disclosure, local compromise, or misuse beyond the immediate CLI response.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI writes the full search output to a local JSON file, including the user's keyword and returned result set, even though the skill description emphasizes returning search results rather than persisting them. Undisclosed local persistence expands the data exposure surface because sensitive or proprietary queries may remain on disk, be picked up by other tools, or be accessed by other local users/processes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Automatically saving task results to logs/ can expose sensitive business intelligence such as tracked keywords, profile links, scraped content, and analysis outputs to other local users, backups, or downstream tooling. Because the README does not warn users about retention, access controls, or redaction, operators may unknowingly persist data that should remain ephemeral.

Missing User Warnings

Medium

Confidence: 75% confidence
Finding: The tool persists retrieved profile-related results to a local JSON file automatically, without obtaining consent or warning the user. This can expose scraped profile data to other local users, backups, or downstream processes, especially on shared systems or when the output contains links and interaction metadata that users did not expect to store.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill stores search results locally without clearly disclosing that behavior to the user in the runtime flow or help as a persistence side effect. Because search queries can reveal user interests, investigations, or business intent, silent retention can create privacy and compliance risk beyond the expected search operation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.